Topic

IoT Security: news, advisories and analysis

12 articlesUpdated 2 Oct 2026

CyberSecureToday covers IoT Security across 12 articles published between 17 Sep 2026 and 2 Oct 2026. The coverage includes 12 vulnerability advisories. 12 advisories are rated critical or high severity, and 1 involves a flaw listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on IoT Security most often intersect with Command Injection, IEC 62443 and RTSP, with Industrial, OT & IoT the most affected sector. The most recent story, “Meari IoT Cloud OpenAPI Flaws Expose Smart Surveillance Device Shadows and Controls”, was published 2 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSHigh
Meari IoT Cloud OpenAPI Flaws Expose Smart Surveillance Device Shadows and Controls
CISA advisory ICSA-26-274-06 details critical Broken Object Level Authorization in Meari IoT Cloud OpenAPI, exposing millions of surveillance devices worldwide.
Priya Raman2 Oct 20268 min read
ThreatsIndustrial & OTCritical
Anjvision Industrial Video Streaming Transcoders Compromised by Critical Unauthenticated Command Injection (CVE-2026-100291)
CISA advisory ICSA-26-272-05 exposes critical unauthenticated command injection and credential disclosure vulnerabilities across Anjvision streaming transcoders.
CST Editorial Desk1 Oct 20269 min read
ThreatsIndustrial & OTCritical
Tenda GPON Optical Network Terminals Open to Remote Code Execution via Overflow
A critical stack-based buffer overflow in Tenda GPON optical terminals allows unauthenticated remote attackers on the WAN interface to achieve root command execution.
CST Editorial Desk1 Oct 202610 min read
ThreatsIndustrial & OTCritical
ASUS Enterprise and Gateway Routers Format String Vulnerability Enables Arbitrary Remote Execution (CVE-2026-14157)
A critical format string vulnerability in ASUS gateway router web modules allows authenticated attackers to execute arbitrary code with root privileges.
CST Editorial Desk1 Oct 202611 min read
ThreatsIndustrial & OTCritical
Eufy Omni Appliance Command Injection Flaw Exposes Facility Networks to Root Compromise
CISA issues advisory ICSA-26-267-02 for critical command injection flaw CVE-2026-93289 in Eufy Omni robotic appliances enabling unauthenticated root code execution.
CST Editorial Desk26 Sep 202614 min read
ThreatsIndustrial & OTCritical
Eufy Facility Robots Vulnerable to Remote Video Interception and Fleet Takeover
CISA ICS advisory ICSA-26-267-02 warns of critical vulnerabilities in Eufy autonomous commercial cleaning robots, allowing remote RTSP stream hijack and LiDAR map exfiltration.
CST Editorial Desk25 Sep 202616 min read
ThreatsIndustrial & OTCritical
Botslab Dashcam Flaws Expose Commercial Fleet Telematics to Remote Video Hijacking
CISA ICS advisory ICSA-26-267-01 details critical flaws in Botslab G980H dashcams, allowing remote attackers to intercept live video and hijack fleet telematics.
Daniel Okafor25 Sep 202616 min read
ThreatsIndustrial & OTHigh
lwIP TCP/IP Stack Double Free Flaw Exposes Industrial Controllers to Remote Hijacking
CISA and lwIP maintainers warn of high-severity flaw CVE-2026-91018 in the lwIP TCP/IP stack allowing unauthenticated remote memory corruption across IoT and PLCs.
CST Editorial Desk23 Sep 202616 min read
ThreatsIndustrial & OTHigh
CareCam CM2507 IP Cameras Exposed to Video Stream Interception and Privileged Access Takeover CVE-2026-88259
CISA issues advisory for CareCam CM2507 IP cameras detailing unauthenticated video streaming, empty ONVIF passwords, and hardcoded root hashes risking facility surveillance.
CST Editorial Desk22 Sep 202615 min read
ThreatsIndustrial & OTHigh
Bransys Electronic Logging Devices Exposed to Fleet Telemetry Hijack via Hardcoded MQTT Credentials Flaw CVE-2026-86520
CISA advisory ICSA-26-260-01 details hardcoded MQTT credentials across Bransys ELD telematics units, allowing remote adversaries to eavesdrop on live freight telemetry.
CST Editorial Desk22 Sep 202615 min read
ThreatsCloud & SaaSHigh
AWS Patches Hostname Validation Bypass in IoT Device SDK Exposing Core Endpoints to AiTM Attacks
AWS resolves high-severity vulnerability CVE-2026-92943 in AWS IoT Device SDK for Python allowing adversary-in-the-middle telemetry interception and message spoofing.
Daniel Okafor19 Sep 202610 min read
ThreatsCloud & SaaSCritical
DD-WRT Gateway Firmware Stack Buffer Overflow CVE-2021-27137 Weaponized in Network Perimeter Attacks
CISA adds DD-WRT gateway vulnerability CVE-2021-27137 (CVSS 9.8) to KEV catalog following active weaponization by botnets targeting network perimeter routers.
Aisha Noor17 Sep 202613 min read